AI Detection Rule Passes Linting but Fails Integration Test in CI/CD

Intermediate SANS SEC598 cybersecurity drill: Your detection-as-code pipeline runs two gates before merging: a Sigma linter and a Splunk integration test